AI code security companies

The "cyber-defense Devin that reviews every PR" idea already has upward of thirty companies chasing it, and as of late 2025 all three frontier labs — OpenAI, Google DeepMind, Anthropic — shipped a version of it themselves, mostly for free. The shallow layer (a bot commenting on a pull request) is commoditized and bundled into tools developers already pay for. The layers that are not solved — validating a finding is actually exploitable, reasoning about a whole repository instead of a diff, and producing a fix a team will trust enough to auto-merge — are where the real contest is, and nobody has cracked the last one yet, including the labs with the most compute in the world.

#The master table

#Frontier labs' own products

Company	What it does	Funding / status	Model strategy	Pricing	Differentiator	Weakness
OpenAI Codex Security (formerly Aardvark)	Reads a repo, builds a threat model, monitors commits, validates exploitability in a sandbox, proposes fixes via Codex	Internal OpenAI product, announced 31 Oct 2025 OpenAI; renamed Codex Security, still research preview, not GA	GPT-5, wrapped in a proprietary agentic scaffold	Free scanning for selected non-commercial OSS repos; commercial pricing not published	Claims 92% recall on a vendor-built "golden" benchmark and 10 CVEs from OSS scanning OpenAI · The Hacker News	No published false-positive rate; research preview, not broadly available
Google DeepMind CodeMender	Multi-agent patcher: static/dynamic analysis, fuzzing, SMT solvers, plus a dedicated "critic" agent that checks its own patches	Internal, announced 6 Oct 2025 DeepMind	Gemini Deep Think + classical program-analysis tooling	Not commercialized	Upstreamed 72 security patches in six months, incl. a libwebp rewrite that would have prevented CVE-2023-4863 DeepMind	All patches still require human review before merge — even Google won't auto-merge its own agent's output
Anthropic — Claude Code security review	Built-in /security-review command, an open GitHub Action, and an enterprise "Claude Security" scanning product	Shipped from closed preview through 2025–2026 VentureBeat · GitHub · The New Stack	Claude models directly	/security-review and the GitHub Action are free	Claims 500+ vulnerabilities found across internal and partner codebases pre-launch VentureBeat	Self-reported figure, no independent audit; enterprise product is new and thin on public track record

#Pure-play AI AppSec challengers

Company	What it does	Funding (latest)	Model strategy	Pricing	Differentiator	Weakness
Semgrep	SAST engine + Assistant/Guardian AI triage layer	$100M Series D, Feb 2025, Menlo Ventures Semgrep	Open-source rule engine + Anthropic Claude for triage — confirmed by Anthropic's own case study	Teams $30/contributor/mo (Code or Supply Chain), $15 (Secrets); real median ACV $54,000 (range $20K–$193K) [buyers pricing notes]	Claims 96% agreement with security researchers and 60% auto-triage of findings — both self-reported Semgrep	96%/60% are internal evals on Semgrep's own benchmark, not third-party audited
Snyk	DeepCode AI — symbolic/semantic engine + LLM-based fix generation ("DeepCode AI Fix")	Historically $530M Series G at $8.5B (2021); a 2026 confidential S-1 at ~$7.4B is reported but [unverified]	Hybrid: deterministic detection engine (pre-LLM era) + LLM fix layer Snyk	Team $25/dev/mo, Ignite $1,260/dev/yr; real median ACV $45,030, range $13K–$182K, n=278 Vendr	Markets detection as not LLM-based — only the fix is generative	G2 reviewers cite "false positives... hinder efficiency" as a recurring complaint
Socket	Supply-chain/dependency scanner for npm/PyPI etc.	$60M Series C, May 2026	LLM-assisted behavioral analysis on top of static package inspection	Free (unlimited devs, 1,000 scans/mo), Team $25/dev/mo, Business $50/dev/mo	$1B valuation; pitched explicitly around AI-generated dependency sprawl Bloomberg	Narrow scope — supply chain only, not general SAST
Endor Labs	SCA/dependency-risk platform expanding into scanning AI-generated code	$93M Series B, April 2025	Not disclosed	Not publicly listed (seat-based)	Explicit "securing the AI code revolution" framing TechCrunch	Pricing opacity vs. Snyk/Semgrep
Aikido Security	All-in-one AppSec (SAST/SCA/secrets/IaC/DAST/cloud) with an "autonomous AI security engineer"	$60M Series B, Jan 2026, PSG Equity	Frontend over multiple detection engines + AI remediation	Basic $300/mo flat, Pro $600/mo flat, Advanced $600+/mo	Belgium's 7th unicorn, $1B valuation Globe Newswire; acquired PR-review startup Trag in 2026	Flat org-level pricing tiers can undercharge large orgs, overcharge small ones
ZeroPath	Continuous repo scanning + auto-generated fix PRs	~$5–20M seed reported, exact figure [unverified] — sources conflict	Frontier-API wrapper (undisclosed which)	$1,000/mo base + $60/dev/mo	Positions directly against Snyk/Semgrep on "PR-native" workflow	Small team, unproven at scale vs. incumbents
Corgea	AI SAST-remediation ("BLAST") — finds and auto-fixes	$2.6M seed, Nov 2024, YC S23	Frontier-API wrapper	Free (2 devs), Growth $39/dev/mo, Scale $49/dev/mo	Meters "fixes," not just seats — 10/50/200 auto-fixes per tier by plan	Smallest disclosed raise in the category; no Series A found
Pixee	"Pixeebot" — opens fix PRs for findings from other scanners (Semgrep, CodeQL, Snyk)	$15M seed, May 2025, Ballistic Ventures	Frontier-API wrapper, detection-agnostic by design	Not published	Fixer-only, explicitly targets "the velocity of GenAI-enabled developers" BusinessWire	Depends entirely on the quality of upstream scanner findings
DryRun Security	"Contextual Security Analysis" — natural-language security policies applied to PR diffs	$8.7M seed, Jan 2025	Frontier-API wrapper	Not published	Context-aware framing vs. pattern-based SAST	Unproven precision claims, no third-party benchmark found
Mobb	Fixer-only — ingests findings from Snyk/Checkmarx/etc., generates validated fix PRs	$5.4M seed (2023); no later round found	Frontier-API wrapper	Not published	On Microsoft Marketplace; narrowly scoped	Funding has gone quiet since 2023 — a possible stall signal
Nullify	"First AI workforce for product security" — autonomous SAST/DAST/pentest-style agents	$12.5M seed + $17.8M reseed by Feb 2026	Frontier-API wrapper	Not published	Broadest scope claim in the cluster (SAST+DAST+pentest)	Broad scope claims are hardest to independently verify
Ghost Security	AI-driven API/attack-surface security	$15M seed (stealth exit); no later round confirmed [unverified]	Frontier-API wrapper	Not published	Runtime/API attack-surface focus, not SDLC-review	Adjacent category — competes less directly with the PR-review cluster
Almanax	AI agent for smart-contract (Web3) auditing	$1M pre-seed, Jan 2025	Frontier-API wrapper	Not published	Narrow, defensible niche (smart-contract audit)	Very early stage; niche is small relative to general SDLC AppSec
Amplify Security	Autonomous vuln validation/remediation (name collides with an unrelated identity-security company, "Amplifier Security")	Funding data did not surface cleanly; treat with caution [unverified]	Frontier-API wrapper	Not published	—	Even its funding history is hard to disambiguate from a same-named company

#Platform incumbents

Company	What it does	Status	Pricing	Differentiator	Weakness
GitHub Advanced Security / Copilot Autofix	CodeQL symbolic analysis + Copilot LLM suggested fixes	Owned by Microsoft; restructuring into separate Code Security / Secret Protection SKUs through 2025–2026	List not published; Vendr negotiated $30–60/active committer/mo Vendr	Platform leverage — attach-rate add-on to an Enterprise Cloud contract customers already have	Real pricing is opaque and a "moving target" mid-restructure
GitLab Duo	Vulnerability Resolution / Duo Chat security tied to GitLab's SAST/DAST	Bundled add-on on GitLab Ultimate/Duo	Not separately published	Ships inside a platform teams already run CI/CD through	Security-specific pricing and adoption data not disclosed
Checkmarx One	Legacy SAST/SCA suite	Acquired Tromzo (ASPM/risk orchestration), Dec 2025, explicitly "to launch agentic AppSec" BusinessWire	Custom; real median ACV $60,950, n≈33 Vendr	Deep enterprise entrenchment	G2: "significant number of false positives," worse for Kotlin
Veracode	Legacy SAST/DAST/SCA suite	Acquired Phylum (SCA), Jan 2025; expanded AI-powered SCA "Fix," March 2026	Custom, scales by app count; real median ACV $23,774, n=87 Vendr	Buying AI capability rather than rebuilding the engine	App-count licensing is a poor fit for modern monorepos
Sonar (SonarQube/SonarCloud)	Static analysis engine	Shipped "AI CodeFix," an LLM auto-remediation layer, across 2025 LTA releases Sonar	Custom	Long-standing developer mindshare, huge install base	Bolted-on AI, not rebuilt around it

#General AI code reviewers (security as a feature, not the pitch)

Company	What it does	Funding	Pricing	Differentiator	Weakness
CodeRabbit	Full-PR LLM reviewer, marketed at catching bugs in "vibe coded" AI PRs	$60M Series B, Sept 2025, Scale Venture Partners, $550M valuation BusinessWire	Pro $24/user/mo, Pro Plus $48/user/mo, security add-on $40/user/mo	Fastest-growing name in the category by funding	Security is an add-on tier, not the core product
Cursor Bugbot	Reviews PRs directly on GitHub, "learns rules" per repo	Part of Cursor/Anysphere, not separately funded	Bundled in Cursor Pro ($20/mo) / Teams ($40/user/mo)	Per-repo learned tuning — an implicit admission that out-of-the-box precision isn't enough Cursor	Not security-first; usage-based cost is opaque at scale
Greptile	Full-codebase-context review bot (not diff-only)	$25–30M raised; a "$180M valuation target" is [unverified] headline, not a closed round	Free (50 credits), Pro $30/seat/mo + $1/extra credit	Claims an "82% bug catch rate" — community/vendor-adjacent claim, not Greptile's own official number dev.to	Usage-based pricing reportedly turns expensive at scale
Graphite / Diamond	AI reviewer bundled into a stacked-PR workflow tool	$52M Series B, March 2025, backed in part by Anthropic	Not published	Explicit stance that "AI will never replace human review" — augment, not replace Graphite	Positioning deliberately caps ambition below full autonomy
Qodo (formerly CodiumAI)	Test-generation + PR-review agent	~$40–50M raised across rounds, exact dates inconsistent across sources [unverified]	Not published	"Code integrity" framing, broader than security	Not security-first; competes on a different axis
Devin (Cognition)	"Devin Review" with a dedicated "Security Swarm" mode	$1B raised at ~$25B pre-money, May 2026, up from $400M/$10B in Sept 2025 TechCrunch	Free, Pro $20/mo, Max $200/mo, Teams $80/mo + $40/seat	Markets itself as clearing vulnerability backlogs autonomously, catching "flaws every scanner misses" Cognition	Best-funded name in the whole set, but security is one mode inside a general coding agent, not a focused product

#The layer cake

Four layers, in order of who has actually solved them:

1. Shallow PR-comment review — commoditized and largely free. GitHub (Copilot Autofix, bundled into GHAS), GitLab Duo, Cursor Bugbot, CodeRabbit, Greptile, and the baseline tier of Semgrep/Snyk all now offer "a bot comments on your PR." This is bundled into tools developers already pay for (GitHub, Cursor) or sold at commodity prices ($20–40/seat/mo). If the founder's pitch stops here, it is a feature, not a company.

2. Exploitability validation — unsolved outside the frontier labs. Actually running a candidate exploit in a sandbox to confirm a finding is real, rather than pattern-matching a code shape, is Codex Security's and CodeMender's stated differentiator. No commodity PR-bot (CodeRabbit, Greptile, Bugbot) claims to do this. Codex Security publishes no false-positive rate; CodeMender's fuzzing/SMT-solver pipeline is the most rigorous public description of this layer anyone has given.

3. Whole-repo reasoning — mostly unsolved. Codex Security explicitly builds a repo-level threat model before reviewing a diff. Most PR bots review the diff in isolation; Greptile's "full-codebase-context" claim is the closest a startup gets, but it is still diff-triggered, not proactively threat-modeling. Baz — not in the tables above but worth naming — pushes review even further upstream into the planning stage, reviewing specs before code exists, a genuinely different position in the pipeline SiliconANGLE.

4. Trustworthy autofix — unsolved everywhere. See below. This is the layer that decides whether the founder's product is a scanner with a chatbot bolted on, or something a security team will actually deploy unsupervised.

#The signal-to-noise problem

What practitioners complain about is well documented and not flattering to anyone. G2's aggregate SAST category data (118 products, 5,500+ reviews) names false positives as the most consistently repeated complaint across both legacy and AI-era tools: Checkmarx ("significant number of false positives," worse for Kotlin), Snyk ("false positives... hinder efficiency"), SonarQube ("false positives that complicate usage"), GitGuardian ("excessive notifications," "overwhelming") — see Who buys, and what they pay for the full breakdown. This cuts across vendor generation: being AI-native does not appear to have fixed the noise problem yet.

What vendors claim is a different, incompatible set of numbers:

• Semgrep: 96% agreement with security researchers, 60% auto-triage of incoming findings — both self-reported, evaluated on Semgrep's own internal benchmark Semgrep.
• OpenAI Codex Security (Aardvark): 92% recall on a vendor-constructed "golden" set of known/synthetic vulnerabilities, no published false-positive rate OpenAI.
• Greptile: an 82% "bug catch rate" — not Greptile's own official published number, but a community/review-site figure that circulates as if it were one dev.to.

These three numbers cannot be ranked against each other. They measure different things (agreement rate vs. recall vs. an undefined "catch rate"), on different benchmark sets (an internal eval, a vendor-curated golden set, an unspecified sample), none independently audited, none run on a shared held-out test. A reader who takes "92% > 82% > matches-if-you-squint 96%" as a leaderboard is being misled by the format of the numbers, not informed by their content.

#The autonomous-fixing frontier

Autonomous finding is well ahead of autonomous fixing in actual deployed trust, and the gap is total — nobody in this market, including the frontier labs, auto-merges a security patch unsupervised.

• CodeMender: 72 patches upstreamed in six months, and Google is explicit that every one of them went through human review before merge DeepMind.
• Codex Security: still research preview; no evidence of production-scale autonomous-fix adoption outside OpenAI's own use.
• Mobb, Pixee, Snyk DeepCode AI Fix: all explicitly generate PRs for human approval — the product design itself assumes a human gate stays standard.
• Corgea, Semgrep, Aikido: all meter "AI fixes" as a distinct consumption tier (Corgea: 10/50/200 fixes per plan; Aikido: capped free, unlimited from $300/mo) — evidence that vendors believe buyers will pay specifically for fix-throughput. But none price on verified outcome (e.g., "$X per vulnerability actually closed"), because attributing a closed vulnerability to the tool rather than to a human who noticed the flag independently is an unsolved billing and trust problem.
• A directionally consistent, if not code-specific, signal from adjacent IT-ops research: a Kiteworks/Action1 survey found 53% of sysadmins say they won't trust AI alone with production systems Kiteworks.

#The platform risk

All three frontier labs shipped a competing product in roughly the same twelve-month window: CodeMender (6 Oct 2025), Aardvark/Codex Security (31 Oct 2025), and Anthropic's Claude Code security tooling through the following year. This is not a coincidence of timing so much as a structural fact about the category: the labs are not staying upstream as API providers — they are shipping the end-user product themselves, often for free or as a loss-leader (Codex Security's free OSS scanning; Anthropic's /security-review command and open GitHub Action).

The reason this is dangerous for the startups in the tables above, rather than just competitive pressure, is where the actual IP sits. None of the pure-play challengers (ZeroPath, Corgea, Pixee, Mobb, DryRun, Nullify) claim to have pretrained a foundation model — every one of them is a fine-tuning or prompt-engineering layer over a rented frontier API Post-training playbook. The defensible part of this business was never going to be the model; it's the surrounding system — a proprietary deterministic engine (Snyk's DeepCode symbolic/semantic layer predates the LLM era by years), a validation/sandbox pipeline (Codex Security, CodeMender), or a fine-tuned triage layer with a genuine precision track record (Semgrep's 96% claim, however self-reported). A company that is "GPT-5 plus a scanning prompt" and nothing else has no answer when OpenAI ships exactly that, for free, to the same buyer. See What the frontier labs do themselves and What could actually be defensible.

The legacy incumbents' response has been structurally different and slower: acquire a smaller AI-native startup and bolt its capability onto the existing scanner, rather than rebuild the core engine around LLMs — Checkmarx buying Tromzo (Dec 2025), Veracode buying Phylum (Jan 2025) and separately expanding AI-powered SCA remediation (March 2026), Cycode buying Bearer (March 2024). That posture protects the incumbents' revenue base but does not close the capability gap with the labs; it mainly signals that the incumbents have conceded they cannot out-build OpenAI or Google on the core reasoning layer, only out-distribute them into an existing enterprise install base.

#What this means for us

• Do not build at layer 1. PR-comment review is free from GitHub and Cursor, and cheap from CodeRabbit and Greptile — there is no price point at which a thin wrapper wins that fight.
• Layers 2–4 (exploitability validation, whole-repo threat modeling, trustworthy autofix) are unsolved by everyone, including OpenAI and Google — that is the actual white space, not "better detection."
• Do not lead with an autonomous-merge pitch. It is the one claim that even Google's most rigorous public system (CodeMender, with a dedicated critic agent) has not made. Lead with validated, low-noise findings and a human-gated fix; earn the merge-autonomy claim later, with a track record, or don't make it at all.
• Every self-reported precision/recall number in this market (Semgrep's 96%, Aardvark's 92%, Greptile's 82%) is vendor-benchmarked on a vendor-chosen set. If we ever publish a number, publish the benchmark, the held-out set, and the methodology — that alone would be a differentiator, because nobody else in the table above has done it.
• The platform-risk problem is existential, not competitive: Codex Security and Claude Code security review are free or near-free today. Any plan that assumes a 12–18 month runway before a lab undercuts a specific feature is optimistic — build on capabilities a lab is structurally unlikely to give away (see Is frontier-lab gating a real wedge?, Data, and whether a moat is possible), not on wrapping their own model against them.
• If the "reviews every PR" idea survives this landscape at all, it survives as a narrow, deep, trust-engineered product for a specific validation problem — closer to CodeMender's critic-agent rigor than to CodeRabbit's breadth — sold on a track record, not a demo. Cross-reference against Offensive AI security companies and The AI cyber lab category before committing; the adjacent SOC market (see AI SOC and detection companies) has a very different, and arguably worse, risk profile for a new entrant.